\nMore than 40 million Americans change their addresses annually and submit change of address (COA) orders to the U.S. Postal Service. Customers can submit orders electronically through the Internet or submit hard copy orders through the mail or at a Post Office retail counter. The Postal Service provides COA information for a fee through National Change of Address Linkage (NCOALink) to licensees who facilitate relationships with business mailers. NCOALink is an application containing about 160 million COA records. The Postal Service requires licensees and their customers to complete a Processing Acknowledgment Form (acknowledgement form) to comply with the Privacy Act of 1974 and document the companies\u2019 intended use of the data.
![\"OIG-Logo\"](\"https:\/\/postalemployeenetwork.com\/news\/wp-content\/uploads\/2014\/03\/OIG-Logo.gif\"){kind=logo}
<\/a><\/em><\/p>\nOur objectives were to determine whether security controls over the COA manual process and NCOALink data adequately protect the confidentiality and integrity of customer data and identify potential solutions for improving the Postal Service\u2019s acknowledgement form process.<\/em><\/p>\n What The OIG Found<\/em><\/strong> We also determined the Postal Service is using outdated software to [word redacted by OIG] data. In addition, NCOALink license agreements did not always have sufficient contract provisions to protect customer data, and management did not always monitor these agreements for licensee compliance.<\/em><\/p>\n
\nSecurity controls over the COA manual processes and NCOALink data are not sufficient to protect the confidentiality and integrity of customer information. We visited one of the 22 Computerized Forwarding System sites and found personnel did not adhere to controls related to processing and retaining hard copy COA orders.<\/em><\/p>\n